A new study finds that how you grade an AI safety test matters far more than how you wrap the AI answering it.
Researchers ran six leading models through four pre-registered safety benchmarks, testing each with a direct API call and three scaffolds meant to mimic real deployments: ReAct, multi-agent, and map-reduce setups. Across 62,808 scored evaluations, switching a benchmark question from multiple-choice to open-ended format shifted measured safety scores by 5 to 20 percentage points, even when the underlying question was identical. That gap comes from scoring method - answer extraction versus an LLM judge - not from the model actually behaving differently. A common shortcut, using a keyword heuristic to flag refusals, would have changed the findings in five separate cases.
Benchmark format explained 19.3% of the variation in safety results, while the scaffold wrapped around the model explained just 0.4%, a 45x gap. The one exception was map-reduce, which decomposes a prompt and strips out its answer options, dragging pooled measured safety down 7.3 percentage points. That average hides wild swings: on the same sycophancy test, Opus 4.6 scored 16.8 points worse under map-reduce while Llama 4 scored 18.8 points better.
The paper's most damning number is its reliability score for combining all this into one safety metric: a confidence interval so wide it cannot rule out the composite being close to useless. Any team green-lighting a launch off a single safety score should read that part twice.